CVE-2026-53930 Overview
CVE-2026-53930 is a Server-Side Request Forgery (SSRF) vulnerability in NocoDB, an open-source platform for building databases as spreadsheets. The base-migration endpoint accepted a caller-supplied URL that the migration worker dereferenced without validating the protocol or destination. Attackers with sufficient privileges can abuse non-HTTP schemes such as file: and ftp:, and probe internal HTTP destinations reachable from the server. The flaw is tracked as [CWE-918] and is fixed in NocoDB version 2026.05.1.
Critical Impact
Authenticated attackers can coerce the NocoDB migration worker to dereference arbitrary URLs, enabling internal network probing and local file access through scheme abuse.
Affected Products
- NocoDB versions prior to 2026.05.1
- NocoDB self-hosted deployments exposing the base-migration endpoint
- NocoDB instances accessible to authenticated users with migration privileges
Discovery Timeline
- 2026-06-23 - CVE-2026-53930 published to NVD
- 2026-06-25 - Last updated in NVD database
Technical Details for CVE-2026-53930
Vulnerability Analysis
The vulnerability resides in the NocoDB base-migration endpoint. The endpoint accepts a URL parameter from the caller and passes it to a backend migration worker. The worker dereferences the URL without validating either the protocol scheme or the destination host. This permits Server-Side Request Forgery, where the server is coerced into issuing requests on behalf of the attacker.
Because no allow-list of schemes is enforced, attackers can supply non-HTTP URIs such as file:// to read local files or ftp:// to interact with arbitrary FTP services. The same lack of destination validation allows probing of internal HTTP endpoints such as cloud metadata services, internal admin consoles, or service discovery APIs that are otherwise unreachable from the public network. The vulnerability is categorized under [CWE-918] Server-Side Request Forgery.
Root Cause
The root cause is missing input validation on a user-supplied URL. The migration worker trusts the caller to provide a safe URL and performs no scheme allow-listing, destination filtering, or DNS rebinding protection before issuing the outbound request.
Attack Vector
Exploitation requires network access to the NocoDB API and authenticated privileges sufficient to invoke the base-migration endpoint. The attacker submits a migration request whose URL field points to an internal address or uses a dangerous scheme. The server returns or leaks response data, error messages, or timing differences that confirm reachability and disclose internal resources.
No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-h6vv-pcq8-7xm4 for vendor-provided technical detail.
Detection Methods for CVE-2026-53930
Indicators of Compromise
- Outbound requests from the NocoDB process to internal RFC1918 ranges, link-local addresses such as 169.254.169.254, or localhost.
- HTTP access logs showing POST requests to the base-migration endpoint with URL parameters referencing file:, ftp:, gopher:, or dict: schemes.
- Unexpected file read errors or stack traces in NocoDB logs referencing URL dereference operations against local paths.
Detection Strategies
- Inspect NocoDB application logs for base-migration invocations and extract the submitted URL value for review against an allow-list.
- Correlate authentication events with subsequent outbound connections from the NocoDB host to detect anomalous server-initiated traffic.
- Apply web application firewall rules that match non-HTTP URI schemes in migration request bodies.
Monitoring Recommendations
- Monitor egress traffic from NocoDB hosts to cloud metadata endpoints and internal management subnets.
- Alert on NocoDB processes opening local file handles outside expected data directories.
- Track per-user invocation rates of the base-migration endpoint and flag unusual spikes.
How to Mitigate CVE-2026-53930
Immediate Actions Required
- Upgrade NocoDB to version 2026.05.1 or later, which contains the upstream fix.
- Restrict network egress from NocoDB hosts to only the destinations required for legitimate migration operations.
- Audit accounts with migration privileges and remove access from users who do not require it.
Patch Information
The NocoDB maintainers fixed the issue in version 2026.05.1. The patch enforces scheme validation and destination restrictions on URLs supplied to the migration worker. Refer to the NocoDB GitHub Security Advisory for the official vendor advisory.
Workarounds
- Place NocoDB behind a reverse proxy that strips or validates URL parameters submitted to migration endpoints.
- Use host-level firewall rules or network policies to block NocoDB from reaching cloud metadata services and internal administrative interfaces.
- Disable or restrict access to the base-migration endpoint until the upgrade is applied.
# Example egress restriction using iptables to block cloud metadata access from the NocoDB host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
